2026-10-28 04:34:26
(17 hours ago)
Attempted access to sensitive endpoint (/.env.local?import&raw) detected. Automated scan or unauthorized probing.
Web App Attack
2026-10-27 18:59:06
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇩🇪
TheDjRider
2026-10-27 12:36:12
(1 day ago)
CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ban triggered. Detection time (UTC): 2026-10-27T12:36:09.63769575Z. Context: http_status=404
Web App Attack
🇳🇱
Site.eu
2026-10-27 10:24:49
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 04:42:08
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.53.228.139 (139.228.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:42:01.313345 2026] [security2:error] [pid 22722:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.228.139 (139.228.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:42:01.313345 2026] [security2:error] [pid 22722:tid 22722] [client 34.53.228.139:34750] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.wadenelson.com"] [uri "/.htpasswd"] [unique_id "auArmQhqeoXhBv2zVDZ_IQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-27 03:18:15
(1 day ago)
[ti-14al] Web exploit scanning: 10 suspicious requests detected by fail2ban jail <name>. Example: 34.53.228.139 - - \[27/Oct/2026:04:18:08 +0100\] "GET /.env.example HTTP/1.1" 302 475 "-" "Mozilla/5.0 \(compatible\; Meta-WebIndexer/1.0\; +https://dev ...
show more
[ti-14al] Web exploit scanning: 10 suspicious requests detected by fail2ban jail <name>. Example: 34.53.228.139 - - \[27/Oct/2026:04:18:08 +0100\] "GET /.env.example HTTP/1.1" 302 475 "-" "Mozilla/5.0 \(compatible\; Meta-WebIndexer/1.0\; +https://developers.facebook.com/docs/sharing/webmasters/crawler\)"
34.53.228.139 - - \[27/Oct/2026:04:18:08 +0100\] "GET /.env HTTP/1.1" 302 459 "-" "Mozilla/5.0 \(compatible\; KimiBot/1.0\; +https://kimi.ai/\)"
34.53.228.139 - - \[27/Oct/2026:04:18:08 +0100\] "GET /.env.save HTTP/1.1" 302 469 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; compatible\; Claude-User/1.0\; [email protected] \)"
34.53.228.139 - - \[27/Oct/2026:04:18:08 +0100\] "GET /.env.prod HTTP/1.1" 302 469 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-27 01:46:43
(1 day ago)
[ti-30al] Web exploit scanning: 12 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.53.228.139 - - [27/Oct/2026:02:46:39 +0100] "GET /@fs/var/task/.env?raw?? HTTP/2.0" 404 528 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like ...
show more
[ti-30al] Web exploit scanning: 12 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.53.228.139 - - [27/Oct/2026:02:46:39 +0100] "GET /@fs/var/task/.env?raw?? HTTP/2.0" 404 528 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.53.228.139 - - [27/Oct/2026:02:46:39 +0100] "GET /@fs/.env?import&?raw?? HTTP/2.0" 404 528 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.53.228.139 - - [27/Oct/2026:02:46:39 +0100] "GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/2.0" 404 528 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.53.228.139
...
show less
Bad Web Bot
Web App Attack
🇷🇺
Albram
2026-10-27 00:29:52
(1 day ago)
HTTP automated scanner flood
...
Bad Web Bot
🇩🇪
svr
2026-10-26 23:43:53
(1 day ago)
Abusive Automated Web Scanner
Web App Attack
2026-10-26 21:49:28
(2 days ago)
Banned by Fail2Ban on server
Web App Attack
🇪🇸
pipeline.es
2026-10-26 21:28:08
(2 days ago)
Web scanning / probing for vulnerable paths | URL: /api/_content | Evidence: vpttours.com 34.53.228.139 - - [26/Oct/2026:22:25:04 +0100] \"GET /api/_content HTTP/2.0\" 404 26410 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537. ...
show more
Web scanning / probing for vulnerable paths | URL: /api/_content | Evidence: vpttours.com 34.53.228.139 - - [26/Oct/2026:22:25:04 +0100] \"GET /api/_content HTTP/2.0\" 404 26410 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\" GEOIP_COUNTRY_CODE=BE 22591 | ASN: GOOGLE-CLOUD-PLATFORM | Country: BE
show less
Port Scan
Web App Attack
🇫🇷
dynamix
2026-10-26 19:04:07
(2 days ago)
Multiple WAF Violations
Web App Attack
2026-10-26 18:48:08
(2 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-10-26 18:20:29
(2 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Alboweb B.V.
2026-10-26 08:11:07
(2 days ago)
Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail
Bad Web Bot
